> ## Documentation Index > Fetch the complete documentation index at: https://docs.dueflow.co/llms.txt > Use this file to discover all available pages before exploring further. # Assign a card to a member > > **Requires scope** `cards:write` · **Minimum role** admin Sets the Dueflow member who holds the card, or clears it with `memberId: null` for an organization-owned card. `memberId` is required, so a request without it is refused rather than read as unassigning. Conflicts when the card already has that holder. Dueflow-only bookkeeping; the provider keeps every card under the account owner. [Scopes and roles](https://docs.dueflow.co/api-reference/scopes) ## OpenAPI ````yaml /openapi.json post /v1/cards/{cardId}/assign openapi: 3.1.0 info: title: Dueflow API version: 1.0.0 description: >- Read and write your organization's Dueflow data. Authenticate with a personal access token or an organization service token as a bearer credential; cookies are ignored. Every endpoint is also a tool on the Dueflow MCP server at https://api.dueflow.co/mcp, which accepts the same bearer tokens or an OAuth connection from ChatGPT and Claude. Timestamps in responses are RFC 3339, UTC, millisecond precision (`2026-01-31T17:04:05.123Z`). Timestamps you send are RFC 3339: send UTC (`Z`); some filters, such as `updatedSince`, also accept an offset. Responses may gain fields at any time; ignore the ones you don't know. Every failure answers with the `Error` envelope; branch on its `code`. termsOfService: https://dueflow.co/terms contact: name: Dueflow support email: hello@dueflow.co url: https://docs.dueflow.co servers: - url: https://api.dueflow.co description: Production security: - bearerAuth: [] paths: /v1/cards/{cardId}/assign: post: tags: - Cards summary: Assign a card to a member description: >- > **Requires scope** `cards:write` · **Minimum role** admin Sets the Dueflow member who holds the card, or clears it with `memberId: null` for an organization-owned card. `memberId` is required, so a request without it is refused rather than read as unassigning. Conflicts when the card already has that holder. Dueflow-only bookkeeping; the provider keeps every card under the account owner. [Scopes and roles](https://docs.dueflow.co/api-reference/scopes) operationId: postCardsByCardIdAssign parameters: - name: cardId in: path required: true schema: type: string - name: Idempotency-Key in: header required: true description: >- A unique key per logical operation, e.g. a UUID. Keys are remembered for 24 hours per token: a retry within that window with the same key replays the original response (marked `Idempotent-Replayed: true`) instead of repeating the write; reusing a key with different parameters is a 409. schema: type: string maxLength: 255 requestBody: required: true content: application/json: schema: type: object properties: memberId: anyOf: - type: string - type: 'null' required: - memberId responses: '201': description: Success headers: X-Request-Id: $ref: '#/components/headers/X-Request-Id' RateLimit-Limit: $ref: '#/components/headers/RateLimit-Limit' RateLimit-Remaining: $ref: '#/components/headers/RateLimit-Remaining' RateLimit-Reset: $ref: '#/components/headers/RateLimit-Reset' Idempotent-Replayed: $ref: '#/components/headers/Idempotent-Replayed' content: application/json: schema: $ref: '#/components/schemas/Card' '400': $ref: '#/components/responses/BadRequest' '401': $ref: '#/components/responses/Unauthorized' '403': $ref: '#/components/responses/Forbidden' '404': $ref: '#/components/responses/NotFound' '409': $ref: '#/components/responses/Conflict' '429': $ref: '#/components/responses/RateLimited' default: $ref: '#/components/responses/UnexpectedError' security: - bearerAuth: - cards:write components: headers: X-Request-Id: description: >- Identifies the request; quote it to support. Also in the error body as `requestId`. schema: type: string RateLimit-Limit: description: Requests the token's budget for this kind of request allows per window. schema: type: integer RateLimit-Remaining: description: Requests left in the current window. schema: type: integer RateLimit-Reset: description: Seconds until the window resets. schema: type: integer Idempotent-Replayed: description: >- `true` when this response is the stored answer to an earlier request with the same `Idempotency-Key`. schema: type: string enum: - 'true' Retry-After: description: Seconds to wait before retrying. schema: type: integer schemas: Card: type: object properties: id: type: string name: type: - string - 'null' status: type: - string - 'null' enum: - active - frozen - canceled - invited - denied - null last4: type: - string - 'null' spendLimit: type: - string - 'null' spendLimitFrequency: type: - string - 'null' enum: - daily - weekly - monthly - one_time - null transactionLimit: type: - string - 'null' assignedMemberId: type: - string - 'null' invitedAt: type: - string - 'null' format: date-time description: >- Timestamp: RFC 3339, UTC, millisecond precision (`2026-01-31T17:04:05.123Z`). activatedAt: type: - string - 'null' format: date-time description: >- Timestamp: RFC 3339, UTC, millisecond precision (`2026-01-31T17:04:05.123Z`). canceledAt: type: - string - 'null' format: date-time description: >- Timestamp: RFC 3339, UTC, millisecond precision (`2026-01-31T17:04:05.123Z`). createdAt: type: string format: date-time description: >- Timestamp: RFC 3339, UTC, millisecond precision (`2026-01-31T17:04:05.123Z`). updatedAt: type: string format: date-time description: >- Timestamp: RFC 3339, UTC, millisecond precision (`2026-01-31T17:04:05.123Z`). required: - id - name - status - last4 - spendLimit - spendLimitFrequency - transactionLimit - assignedMemberId - invitedAt - activatedAt - canceledAt - createdAt - updatedAt Error: type: object properties: error: type: object properties: code: description: >- A stable, machine-readable reason. One of `invalid_request` (400), `invalid_token` (401), `insufficient_scope` (403), `step_up_required` (403), `not_found` (404), `method_not_allowed` (405), `conflict` (409), `sync_expired` (410), `rate_limited` (429), `internal_error` (500), `provider_error` (502). New codes may be added; treat an unknown one by its HTTP status. type: string message: type: string param: type: string requiredScopes: type: array items: type: string requestId: type: string docsUrl: type: string required: - code - message - requestId - docsUrl required: - error responses: BadRequest: description: >- Invalid input: a parameter or body field fails validation (`param` names it), the body isn't JSON, or a business rule refused the request. headers: X-Request-Id: $ref: '#/components/headers/X-Request-Id' RateLimit-Limit: $ref: '#/components/headers/RateLimit-Limit' RateLimit-Remaining: $ref: '#/components/headers/RateLimit-Remaining' RateLimit-Reset: $ref: '#/components/headers/RateLimit-Reset' content: application/json: schema: $ref: '#/components/schemas/Error' Unauthorized: description: Missing, malformed, expired or revoked token. headers: X-Request-Id: $ref: '#/components/headers/X-Request-Id' RateLimit-Limit: $ref: '#/components/headers/RateLimit-Limit' RateLimit-Remaining: $ref: '#/components/headers/RateLimit-Remaining' RateLimit-Reset: $ref: '#/components/headers/RateLimit-Reset' content: application/json: schema: $ref: '#/components/schemas/Error' Forbidden: description: The token lacks a required scope. headers: X-Request-Id: $ref: '#/components/headers/X-Request-Id' RateLimit-Limit: $ref: '#/components/headers/RateLimit-Limit' RateLimit-Remaining: $ref: '#/components/headers/RateLimit-Remaining' RateLimit-Reset: $ref: '#/components/headers/RateLimit-Reset' content: application/json: schema: $ref: '#/components/schemas/Error' NotFound: description: No such resource, or the token's organization can't see it. headers: X-Request-Id: $ref: '#/components/headers/X-Request-Id' RateLimit-Limit: $ref: '#/components/headers/RateLimit-Limit' RateLimit-Remaining: $ref: '#/components/headers/RateLimit-Remaining' RateLimit-Reset: $ref: '#/components/headers/RateLimit-Reset' content: application/json: schema: $ref: '#/components/schemas/Error' Conflict: description: >- The write conflicts with existing state, or an `Idempotency-Key` was reused with different parameters. headers: X-Request-Id: $ref: '#/components/headers/X-Request-Id' RateLimit-Limit: $ref: '#/components/headers/RateLimit-Limit' RateLimit-Remaining: $ref: '#/components/headers/RateLimit-Remaining' RateLimit-Reset: $ref: '#/components/headers/RateLimit-Reset' content: application/json: schema: $ref: '#/components/schemas/Error' RateLimited: description: Rate limited; see the `Retry-After` header. headers: X-Request-Id: $ref: '#/components/headers/X-Request-Id' RateLimit-Limit: $ref: '#/components/headers/RateLimit-Limit' RateLimit-Remaining: $ref: '#/components/headers/RateLimit-Remaining' RateLimit-Reset: $ref: '#/components/headers/RateLimit-Reset' Retry-After: $ref: '#/components/headers/Retry-After' content: application/json: schema: $ref: '#/components/schemas/Error' UnexpectedError: description: >- Any other failure, such as `internal_error` (500), as the `Error` envelope. A failure in front of the API (a gateway timeout, a request too large) may instead be plain text. headers: X-Request-Id: $ref: '#/components/headers/X-Request-Id' RateLimit-Limit: $ref: '#/components/headers/RateLimit-Limit' RateLimit-Remaining: $ref: '#/components/headers/RateLimit-Remaining' RateLimit-Reset: $ref: '#/components/headers/RateLimit-Reset' content: application/json: schema: $ref: '#/components/schemas/Error' text/plain: schema: type: string securitySchemes: bearerAuth: type: http scheme: bearer description: >- A Dueflow access token: `dfp_` (personal) or `dfs_` (service). Permissions are the token's scopes intersected with the role ceiling, re-evaluated per request. ```` This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.